The port is open and is accessable via telnet, But sadly it has a password.
Are there any default combos that the router comes with or any way to find the credentials?
Anyway to gain access to a Cisco router telnet? |
I'd check to see if snmp public/private community string is enabled and if it's set to default (public/Pivate) (snmpcheck)
If so, use scapy to try and download a copy of the running config. If the password is encrypted, upload a new config with a new enable password, then log in. I really comes down to someones miss configuration. It's a remote chance, but worth a shot. 
Nov 20, 2017 08:01 AM
(This post was last modified: Nov 20, 2017 08:03 AM by 7_R3X.)
How about MITM? If the target host is on the same LAN as of your machine, poison the ARP, get the traffic redirected to your machine and start a sniffer with filters upon target's IP address. Telnet, by its nature, is unencrypted. You'd get the password in plaintext. It'd hardly take a few minutes if the telnet service on the target is under heavy use. I'd also recommend you to spoof your MAC address before you start poisoning the ARP.
Hope it helps! Good luck! 🤝 
Nov 21, 2017 11:53 AM
(This post was last modified: Nov 21, 2017 11:53 AM by bziumek.)
(Nov 19, 2017 06:21 PM)๖ۣۜMemelord Wrote: Try cisco/cisco, other way you might need some RCE exploit for CVE-2017-3881 bug. At Internet you can find some ready-to-use exploit, but targeted only for few models of Catalyst. If you have SNMP open, or you know SNMP community you can try use NSA leaked tools like EPICBANANA: |
|
|
